Vulnerabilities (CVE)

Filtered by vendor Gitlab Subscribe
Total 1001 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-1940 1 Gitlab 1 Gitlab 2022-06-13 3.5 LOW 5.4 MEDIUM
A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues
CVE-2022-1936 1 Gitlab 1 Gitlab 2022-06-13 4.0 MEDIUM 6.5 MEDIUM
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured
CVE-2022-1416 1 Gitlab 1 Gitlab 2022-06-02 3.5 LOW 5.4 MEDIUM
Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling
CVE-2021-22187 1 Gitlab 1 Gitlab 2022-05-27 4.0 MEDIUM 4.3 MEDIUM
An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.
CVE-2022-1352 1 Gitlab 1 Gitlab 2022-05-19 5.0 MEDIUM 5.3 MEDIUM
Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.
CVE-2022-1124 1 Gitlab 1 Gitlab 2022-05-18 3.5 LOW 4.3 MEDIUM
An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled
CVE-2022-1426 1 Gitlab 1 Gitlab 2022-05-18 4.3 MEDIUM 3.7 LOW
An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.
CVE-2022-1428 1 Gitlab 1 Gitlab 2022-05-18 4.0 MEDIUM 4.3 MEDIUM
An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced.
CVE-2022-1406 1 Gitlab 1 Gitlab 2022-05-18 4.0 MEDIUM 6.5 MEDIUM
Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project
CVE-2022-1433 1 Gitlab 1 Gitlab 2022-05-18 4.3 MEDIUM 6.1 MEDIUM
An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute.
CVE-2022-1417 1 Gitlab 1 Gitlab 2022-05-18 4.0 MEDIUM 4.3 MEDIUM
Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs
CVE-2022-1175 1 Gitlab 1 Gitlab 2022-05-10 4.3 MEDIUM 6.1 MEDIUM
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.
CVE-2022-0477 1 Gitlab 1 Gitlab 2022-05-05 4.0 MEDIUM 4.9 MEDIUM
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions.
CVE-2021-22248 1 Gitlab 1 Gitlab 2022-05-03 5.0 MEDIUM 5.3 MEDIUM
Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeline information for public projects that have access to pipelines restricted to members only
CVE-2021-22244 1 Gitlab 1 Gitlab 2022-05-03 4.0 MEDIUM 6.5 MEDIUM
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data
CVE-2021-22172 1 Gitlab 1 Gitlab 2022-05-03 4.0 MEDIUM 4.3 MEDIUM
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page
CVE-2021-39914 1 Gitlab 1 Gitlab 2022-05-03 5.0 MEDIUM 4.3 MEDIUM
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user
CVE-2021-22250 1 Gitlab 1 Gitlab 2022-05-03 5.5 MEDIUM 5.4 MEDIUM
Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account
CVE-2021-39889 1 Gitlab 1 Gitlab 2022-05-03 4.0 MEDIUM 4.3 MEDIUM
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch.
CVE-2022-1162 1 Gitlab 1 Gitlab 2022-04-27 7.5 HIGH 9.8 CRITICAL
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts